CVE-2024-3765

A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, AHB7004T-MHV2, AHB8032F-LME and XM530_R80X30-PQ_8M. Affected by this vulnerability is an unknown functionality of the component Sofia Service. The manipulation with the input ff00000000000000000000000000f103250000007b202252657422203a203130302c202253657373696f6e494422203a202230783022207d0a leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-260605 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-284

• https://github.com/netsecfish/xiongmai_incorrect_access_control
• https://github.com/netsecfish/xiongmai_incorrect_access_control/blob/main/pocCheck3-en.py
• https://vuldb.com/?ctiid.260605
• https://vuldb.com/?id.260605
• https://vuldb.com/?submit.311903
• https://github.com/netsecfish/xiongmai_incorrect_access_control
• https://github.com/netsecfish/xiongmai_incorrect_access_control/blob/main/pocCheck3-en.py
• https://vuldb.com/?ctiid.260605
• https://vuldb.com/?id.260605
• https://vuldb.com/?submit.311903

Published

Apr 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37641TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain…8.8
• CVE-2024-37642TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain…9.1
• CVE-2024-37643TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain…8.8
• CVE-2024-37644TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain…8.8
• CVE-2024-37645TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain…8.8
• CVE-2024-37649Insecure Permissions vulnerability in SecureSTATION v.2.5.5.…4.6
• CVE-2024-37654An issue in BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01…6.1
• CVE-2024-37656An open redirect vulnerability in gnuboard5 v.5.5.16 allows …6.1
• CVE-2024-37657An open redirect vulnerability in gnuboard5 v.5.5.16 allows …6.1
• CVE-2024-37658An open redirect vulnerability in gnuboard5 v.5.5.16 allows …6.1
• CVE-2024-3766A vulnerability, which was classified as problematic, has be…2.4
• CVE-2024-37661TP-LINK TL-7DR5130 v1.0.23 is vulnerable to forged ICMP redi…6.3